BLOG: The Importance Of Threat-Led Patch Prioritisation

In this blog we briefly discuss threat led patch prioritisation, to read more on this matter please read our latest whitepaper. 

As the cyber world develops it leaves entry for an abundance of new vulnerabilities for companies to experience. Many companies are now undertaking a process of adopting a threat led and risk-based approach utilising threat intelligence to help them. Threat intelligence provides vulnerability management teams with a great understanding of how attacks work, allowing them to prioritise the threats most likely to come into contact with their environment and this leaves room for them to create some form of structure in order to combat these threats.  

The importance of threat intelligence in evaluating security stances is a necessity nowadays, especially given the continuous new era vulnerabilities developing. Though threat intelligence is able to offer a vast amount of information, it is not enough to pinpoint which vulnerabilities or attack vectors are the most relevant at a given time. This is because we must think about the characteristics of individual attacks and the strategies of attackers enables defenders to prioritize. Instead of defending against all vulnerabilities, which can often do more harm than good based on the fact that if not orchestrated effectively can lead to a data breach alongside the fact that vulnerabilities can number from hundreds to thousands; defenders can prioritise their efforts to focus on a select number that the attacker needs to breach the system. 

The established approach to vulnerability management typically involves periodic scanning of a pre-determined range of assets to determine which systems, software or applications feature known vulnerabilities – also known as CVEs (Common Vulnerabilities and Exposures). However, there are several issues with this model. Despite its widespread adoption – albeit to varying degrees of success – the failure to patch known vulnerabilities continues to dog companies. A Ponemon study estimates that 57% of victims of data breaches were compromised due to their failure to patch known vulnerabilities. 

Download our whitepaper to see: 

• The limitations of a compliance based approach 
• How the number of vulnerabilities has changed over time 
• Why a cyber risk scoring system helps  
• The limitations of a compliance based approach 
• How the number of vulnerabilities has changed over time  
• Why a cyber risk scoring system helps  

Download our whitepaper here: 

[goal id=”2807″]